tor-commits April 2014

tor-commits@lists.torproject.org

22 participants
2020 discussions

[torsocks/master] Add .onion address support
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit bf2db7bc1f0a734410e5988475755abad016ce37 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Jun 24 21:25:20 2013 -0400 Add .onion address support An onion pool subsystem is added which uses an IP subnet defined in the configuration file acting as a cookie pool that are picked and returned to the application. In the connect() process, if the cookie is seen, a lookup is done to find the corresponding onion address and used to connect to Tor. Some modifications was needed in the sock5 and connection ABI/API. Two files are added, onion.c/.h. The connect() call supports hidden service's address at this commit. Some optimization is still possible especially in the onion entry lookup by IP as well as the pool data structure which is now an array. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- doc/torsocks.conf | 6 + src/common/Makefile.am | 2 +- src/common/config-file.c | 77 ++++++++++++- src/common/config-file.h | 7 ++ src/common/connection.c | 30 ++--- src/common/defaults.h | 11 ++ src/common/macros.h | 4 + src/common/onion.c | 272 ++++++++++++++++++++++++++++++++++++++++++++++ src/common/onion.h | 134 +++++++++++++++++++++++ src/common/socks5.c | 15 ++- src/common/utils.c | 17 +++ src/common/utils.h | 1 + src/lib/connect.c | 37 ++++++- src/lib/torsocks.c | 84 ++++++++++++++ src/lib/torsocks.h | 3 + 15 files changed, 674 insertions(+), 26 deletions(-) diff --git a/doc/torsocks.conf b/doc/torsocks.conf index 60eb697..6f4fc04 100644 --- a/doc/torsocks.conf +++ b/doc/torsocks.conf @@ -19,3 +19,9 @@ local = 192.168.0.0/255.255.0.0 # any SOCKS connection and relay the traffic on the Tor network. TorAddress 127.0.0.1 TorPort 9050 + +# Tor hidden sites do not have real IP addresses. This specifies what range of +# IP addresses will be handed to the application as "cookies" for .onion names. +# Of course, you should pick a block of addresses which you aren't going to +# ever need to actually connect to. +OnionAddrRange 127.42.42.0/24 diff --git a/src/common/Makefile.am b/src/common/Makefile.am index 8d8e074..7e75c32 100644 --- a/src/common/Makefile.am +++ b/src/common/Makefile.am @@ -5,4 +5,4 @@ AM_CFLAGS = -fno-strict-aliasing noinst_LTLIBRARIES = libcommon.la libcommon_la_SOURCES = log.c log.h config-file.c config-file.h utils.c utils.h \ compat.c compat.h socks5.c socks5.h \ - connection.c connection.h ht.h ref.h + connection.c connection.h ht.h ref.h onion.c onion.h diff --git a/src/common/config-file.c b/src/common/config-file.c index 0a05325..32c93ea 100644 --- a/src/common/config-file.c +++ b/src/common/config-file.c @@ -17,9 +17,13 @@ * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. */ +#include <arpa/inet.h> #include <assert.h> +#include <limits.h> +#include <netinet/in.h> #include <stdio.h> #include <stdlib.h> +#include <sys/socket.h> #include "config-file.h" #include "log.h" @@ -30,6 +34,66 @@ */ static const char *conf_toraddr_str = "TorAddress"; static const char *conf_torport_str = "TorPort"; +static const char *conf_onion_str = "OnionAddrRange"; + +/* + * Set the onion pool address range in the configuration object using the value + * found in the conf file. + * + * Return 0 on success or else a negative value. + */ +static int set_onion_info(const char *addr, struct configuration *config) +{ + int ret; + unsigned long bit_mask; + char *ip = NULL, *mask = NULL; + in_addr_t net; + + assert(addr); + assert(config); + + ip = strchr(addr, '/'); + if (!ip) { + ERR("[config] Invalid %s value for %s", addr, conf_onion_str); + ret = -EINVAL; + goto error; + } + + mask = strdup(addr + (ip - addr) + 1); + ip = strndup(addr, ip - addr); + if (!ip || !mask) { + PERROR("[config] strdup onion addr"); + ret = -ENOMEM; + goto error; + } + + net = inet_addr(ip); + if (net == INADDR_NONE) { + ERR("[config] Invalid IP subnet %s for %s", ip, conf_onion_str); + ret = -EINVAL; + goto error; + } + + /* Expressed in base 10. */ + bit_mask = strtoul(mask, NULL, 10); + if (bit_mask == ULONG_MAX) { + ERR("[config] Invalid mask %s for %s", mask, conf_onion_str); + ret = -EINVAL; + goto error; + } + + memcpy(&config->conf_file.onion_base, &net, + sizeof(config->conf_file.onion_base)); + config->conf_file.onion_mask = (uint8_t) bit_mask; + + DBG("[config] Onion address range set to %s", addr); + ret = 0; + +error: + free(ip); + free(mask); + return ret; +} /* * Set the given string port in a configuration object. @@ -130,6 +194,11 @@ static int parse_config_line(const char *line, struct configuration *config) if (ret < 0) { goto error; } + } else if (!strcmp(tokens[0], conf_onion_str)) { + ret = set_onion_info(tokens[1], config); + if (ret < 0) { + goto error; + } } else { WARN("Config file contains unknown value: %s", line); } @@ -207,7 +276,13 @@ int config_file_read(const char *filename, struct configuration *config) * statement in the function call to set port. */ (void) set_tor_port(XSTR(DEFAULT_TOR_PORT), config); - ret = 0; + + ret = set_onion_info( + DEFAULT_ONION_ADDR_RANGE "/" DEFAULT_ONION_ADDR_MASK, config); + if (!ret) { + /* ENOMEM is probably the only case here. */ + goto error; + } goto end; } diff --git a/src/common/config-file.h b/src/common/config-file.h index b0c2e84..1fc23bf 100644 --- a/src/common/config-file.h +++ b/src/common/config-file.h @@ -35,6 +35,13 @@ struct config_file { char *tor_address; /* The port of the Tor SOCKS. */ in_port_t tor_port; + + /* + * Base for onion address pool and the mask. In the config file, this is + * represented by BASE/MASK like so: 127.0.69.0/24 + */ + in_addr_t onion_base; + uint8_t onion_mask; }; /* diff --git a/src/common/connection.c b/src/common/connection.c index 8fcbcf3..52d7acb 100644 --- a/src/common/connection.c +++ b/src/common/connection.c @@ -174,26 +174,28 @@ struct connection *connection_create(int fd, const struct sockaddr *dest) { struct connection *conn = NULL; - assert(dest); - conn = zmalloc(sizeof(*conn)); if (!conn) { PERROR("zmalloc connection"); goto error; } - switch (dest->sa_family) { - case AF_INET: - conn->dest_addr.domain = CONNECTION_DOMAIN_INET; - memcpy(&conn->dest_addr.u.sin, dest, sizeof(conn->dest_addr.u.sin)); - break; - case AF_INET6: - conn->dest_addr.domain = CONNECTION_DOMAIN_INET6; - memcpy(&conn->dest_addr.u.sin6, dest, sizeof(conn->dest_addr.u.sin6)); - break; - default: - ERR("Connection domain unknown %d", dest->sa_family); - goto error; + if (dest) { + switch (dest->sa_family) { + case AF_INET: + conn->dest_addr.domain = CONNECTION_DOMAIN_INET; + memcpy(&conn->dest_addr.u.sin, dest, + sizeof(conn->dest_addr.u.sin)); + break; + case AF_INET6: + conn->dest_addr.domain = CONNECTION_DOMAIN_INET6; + memcpy(&conn->dest_addr.u.sin6, dest, + sizeof(conn->dest_addr.u.sin6)); + break; + default: + ERR("Connection domain unknown %d", dest->sa_family); + goto error; + } } conn->fd = fd; diff --git a/src/common/defaults.h b/src/common/defaults.h index c127eec..1a2c2fc 100644 --- a/src/common/defaults.h +++ b/src/common/defaults.h @@ -47,4 +47,15 @@ */ #define DEFAULT_MAX_CONF_TOKEN 5 +/* + * Default initial size of the onion pool. + */ +#define DEFAULT_ONION_POOL_SIZE 8 + +/* + * The default onion pool cookie range starting at 0 up to 255. + */ +#define DEFAULT_ONION_ADDR_RANGE "127.42.42.0" +#define DEFAULT_ONION_ADDR_MASK "24" + #endif /* TORSOCKS_DEFAULTS_H */ diff --git a/src/common/macros.h b/src/common/macros.h index 1e98fd6..8b52814 100644 --- a/src/common/macros.h +++ b/src/common/macros.h @@ -41,4 +41,8 @@ #define ATTR_HIDDEN __attribute__((visibility("hidden"))) #endif +#ifndef min +#define min(a, b) ((a) < (b) ? (a) : (b)) +#endif + #endif /* TORSOCKS_MACROS_H */ diff --git a/src/common/onion.c b/src/common/onion.c new file mode 100644 index 0000000..85585e3 --- /dev/null +++ b/src/common/onion.c @@ -0,0 +1,272 @@ +/* + * Copyright (C) 2013 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <assert.h> + +#include "defaults.h" +#include "log.h" +#include "onion.h" + +/* + * Resize pool entries of new_size. + * + * Return 0 on success or else -1. + */ +static int resize_onion_pool(struct onion_pool *pool, uint32_t new_size) +{ + struct onion_entry **tmp; + + assert(new_size > pool->size); + + tmp = realloc(pool->entries, new_size * sizeof(*tmp)); + if (!tmp) { + PERROR("[onion] resize onion pool"); + goto error; + } + + DBG("[onion] Onion pool resized from size %lu to new size %lu", pool->size, + new_size); + + pool->entries = tmp; + pool->size = new_size; + return 0; + +error: + return -1; +} + +/* + * Insert an onion entry in the given pool. + * + * Return 0 on success or else a negative value. + */ +static int insert_onion_entry(struct onion_entry *entry, + struct onion_pool *pool) +{ + int ret; + + assert(entry); + assert(pool); + + if (pool->count > pool->size) { + /* Double the size of the pool. */ + ret = resize_onion_pool(pool, pool->size * 2); + if (ret < 0) { + goto error; + } + } + + pool->entries[pool->next_entry_pos] = entry; + pool->next_entry_pos++; + pool->count++; + ret = 0; + + DBG("[onion] Entry added to the onion pool at index %lu", + pool->next_entry_pos - 1); + +error: + return ret; +} + +/* + * Initialize an already allocated onion pool using the given values. + * + * Return 0 on success or else a negative value. + */ +int onion_pool_init(struct onion_pool *pool, in_addr_t addr, uint8_t mask) +{ + int ret = 0; + + assert(pool); + + if (mask == 0 || mask > 32) { + ERR("[onion] Pool initialized with mask set to %u.", mask); + ret = -EINVAL; + goto error; + } + + DBG("[onion] Pool init with subnet %s and mask %u", + inet_ntoa(*((struct in_addr *) &addr)), mask); + + /* + * Get base of subnet. For example, 127.0.0.68/27 will set the base to 64 + * and the max_pos to 95. + */ + pool->base = (((ntohl(addr) >> (32 - mask)) << (32 - mask)) << 24) >> 24; + pool->max_pos = pool->base + ((1UL << (32 - mask)) - 1); + pool->next_entry_pos = 0; + pool->count = 0; + tsocks_mutex_init(&pool->lock); + + /* + * Get the minimum value between the two to avoid allocating more memory + * than we need. + */ + pool->size = min(DEFAULT_ONION_POOL_SIZE, (pool->max_pos - pool->base) + 1); + + memcpy(&pool->ip_subnet, &addr, sizeof(pool->ip_subnet)); + + pool->entries = zmalloc(sizeof(struct onion_entry *) * pool->size); + if (!pool->entries) { + PERROR("[onion] zmalloc pool init"); + ret = -ENOMEM; + goto error; + } + + DBG("[onion] Pool initialized with base %lu, max_pos %lu and size %lu", + pool->base, pool->max_pos, pool->size); + +error: + return ret; +} + +/* + * Destroy onion pool by freeing every entry. + */ +void onion_pool_destroy(struct onion_pool *pool) +{ + int i; + + assert(pool); + + DBG("[onion] Destroying onion pool containing %u entry", pool->count); + + for (i = 0; i < pool->count; i++) { + onion_entry_destroy(pool->entries[i]); + } + + free(pool->entries); +} + +/* + * Allocate an onion entry object and return the pointer. This MUST be called + * with the onion pool lock acquired. + * + * Return a newly allocated onion entry or else NULL. + */ +struct onion_entry *onion_entry_create(struct onion_pool *pool, + const char *onion_name) +{ + int ret; + uint32_t ip_host_order; + struct onion_entry *entry = NULL; + + assert(pool); + assert(onion_name); + + DBG("[onion] Creating onion entry for name %s", onion_name); + + if (pool->next_entry_pos == pool->max_pos) { + ERR("[onion] Can't create anymore onion entry. Maximum reached (%u)", + pool->max_pos); + goto error; + } + + entry = zmalloc(sizeof(struct onion_entry)); + if (!entry) { + PERROR("[onion] zmalloc entry"); + goto error; + } + + /* Copy hostname and force NULL byte at the end. */ + strncpy(entry->hostname, onion_name, sizeof(entry->hostname)); + entry->hostname[sizeof(entry->hostname) - 1] = '\0'; + + /* + * Create the new IP from the onion pool which will be the cookie returned + * to the caller. + */ + ip_host_order = ntohl(pool->ip_subnet) + pool->next_entry_pos; + entry->ip = htonl(ip_host_order); + + ret = insert_onion_entry(entry, pool); + if (ret < 0) { + onion_entry_destroy(entry); + entry = NULL; + goto error; + } + + DBG("[onion] Entry added with IP address %s used as cookie", + inet_ntoa(*((struct in_addr *) &entry->ip))); + +error: + return entry; +} + +/* + * Find an onion entry by onion address name. The pool lock MUST be acquired + * before calling this. + * + * Return entry on success or else NULL. + */ +struct onion_entry *onion_entry_find_by_name(const char *onion_name, + struct onion_pool *pool) +{ + int i; + struct onion_entry *entry = NULL; + + assert(onion_name); + assert(pool); + + DBG("[onion] Finding onion entry for name %s", onion_name); + + for (i = 0; i < pool->count; i++) { + if (strcmp(onion_name, pool->entries[i]->hostname) == 0) { + entry = pool->entries[i]; + DBG("[onion] Onion entry name %s found in pool.", + entry->hostname); + goto end; + } + } + +end: + return entry; +} + +/* + * Find an onion entry by IP cookie. The pool lock MUST be acquired before + * calling this. + * + * Return entry on success or else NULL. + */ +struct onion_entry *onion_entry_find_by_ip(in_addr_t ip, + struct onion_pool *pool) +{ + int i; + struct onion_entry *entry = NULL; + + DBG("[onion] Finding onion entry for IP %s", + inet_ntoa(*((struct in_addr *) &ip))); + + /* + * XXX: This can be improved by simply getting the offset of the IP with + * the pool subnet which gives the index in the pool entries. For instance, + * 127.0.0.45 with a ip_subnet set to 127.0.0.0/24, the index in the pool + * entries is 45. + */ + for (i = 0; i < pool->count; i++) { + if (pool->entries[i]->ip == ip) { + entry = pool->entries[i]; + DBG("[onion] Onion entry name %s found in pool.", + entry->hostname); + goto end; + } + } + +end: + return entry; +} diff --git a/src/common/onion.h b/src/common/onion.h new file mode 100644 index 0000000..90b4d5b --- /dev/null +++ b/src/common/onion.h @@ -0,0 +1,134 @@ +/* + * Copyright (C) 2013 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef TORSOCKS_ONION_H +#define TORSOCKS_ONION_H + +#include <arpa/inet.h> +#include <stdint.h> +#include <stdlib.h> + +#include "compat.h" +#include "macros.h" /* zmalloc */ + +/* + * Onion entry in the pool. This is to map a cookie IP to an .onion address in + * the connect() process. + */ +struct onion_entry { + /* + * It's always an IPv4 which is taken from the onion IP range. + */ + in_addr_t ip; + + /* + * Maximum host name length plus one for the NULL terminated byte. + */ + char hostname[256]; +}; + +/* + * For .onion address representing an address to a hidden service, a "cookie" + * is used during DNS resolution which represents a specific dead IP address + * that is not routable on the Internet. This cookie is returned to the caller + * and once a connect arrives with an address being a cookie, the connection to + * Tor is done using the corresponding onion address. + * + * This object MUST be accessed and modified inside the torsocks registry lock + * to avoid cookie allocation race. Once an entry object reference is acquired, + * the lock can be released since the object is immutable. + */ +struct onion_pool { + /* + * Subnet used for the cookie address. + */ + in_addr_t ip_subnet; + + /* + * Protects every lookup and insertion in this pool object. + * + * This is nested INSIDE the connection registry lock. + */ + tsocks_mutex_t lock; + + /* Number of valid entry in the pool. */ + uint32_t count; + + /* + * Starting base of available cookie. For a range of 127.0.69.64/26, this + * base value would be 64 and the max value in this case is 127. + * + * If the maxium value is reached, the DNS resolution will fail thus never + * returning any cookie to the caller. + */ + uint32_t base; + uint32_t max_pos; + + /* + * Current size of the array. This is the number of allocated entry in the + * pool which does not represent the number of entry. + */ + uint32_t size; + + /* + * This is the next available entry position. Once the onion entry is added + * to the pool, this counter is incremented. If the pool needs to be + * resized, a reallocation is done and size is updated accordingly. + */ + uint32_t next_entry_pos; + + /* + * Array of onion entry indexed by cookie position. For instance, using the + * IP range 127.0.69.0/24, the array is of maximum size 255 and address + * 127.0.69.32 points to the 32th position in the array. + */ + struct onion_entry **entries; +}; + +/* + * Destroy an onion entry object. + */ +static inline void onion_entry_destroy(struct onion_entry *entry) +{ + free(entry); +} + +/* Onion entry family functions. */ +struct onion_entry *onion_entry_create(struct onion_pool *pool, + const char *onion_name); +struct onion_entry *onion_entry_find_by_name(const char *onion_name, + struct onion_pool *pool); +struct onion_entry *onion_entry_find_by_ip(in_addr_t ip, + struct onion_pool *pool); + +static inline void onion_pool_lock(struct onion_pool *pool) +{ + tsocks_mutex_lock(&pool->lock); +} + +static inline void onion_pool_unlock(struct onion_pool *pool) +{ + tsocks_mutex_unlock(&pool->lock); +} + +/* + * Onion pool function calls. + */ +int onion_pool_init(struct onion_pool *pool, in_addr_t base, uint8_t mask); +void onion_pool_destroy(struct onion_pool *pool); + +#endif /* TORSOCKS_ONION_H */ diff --git a/src/common/socks5.c b/src/common/socks5.c index 91beb05..d24f191 100644 --- a/src/common/socks5.c +++ b/src/common/socks5.c @@ -290,14 +290,17 @@ int socks5_send_connect_request(struct connection *conn) memcpy(buffer, &msg, buf_len); /* Setup domain name request buffer. */ - memcpy(req_name.name, conn->dest_addr.hostname.addr, - sizeof(req_name.name)); - req_name.port = conn->dest_addr.hostname.port; req_name.len = strlen(conn->dest_addr.hostname.addr); + memcpy(req_name.name, conn->dest_addr.hostname.addr, req_name.len); + req_name.port = conn->dest_addr.hostname.port; /* Copy ipv6 request portion in the buffer. */ - memcpy(buffer + buf_len, &req_name, sizeof(req_name)); - buf_len += sizeof(req_name); + memcpy(buffer + buf_len, &req_name.len, sizeof(req_name.len)); + buf_len += sizeof(req_name.len); + memcpy(buffer + buf_len, req_name.name, req_name.len); + buf_len += req_name.len; + memcpy(buffer + buf_len, &req_name.port, sizeof(req_name.port)); + buf_len += sizeof(req_name.port); break; } default: @@ -342,7 +345,7 @@ int socks5_recv_connect_reply(struct connection *conn) /* Len of BND.PORT */ recv_len += sizeof(uint16_t); - switch (tsocks_config.socks5_addr.domain) { + switch (conn->dest_addr.domain) { case CONNECTION_DOMAIN_NAME: /* * Tor returns and IPv4 upon resolution. Same for .onion address. diff --git a/src/common/utils.c b/src/common/utils.c index f041cd1..11a3652 100644 --- a/src/common/utils.c +++ b/src/common/utils.c @@ -157,3 +157,20 @@ char *utils_strsplit(char *separator, char **text, const char *search) return ret; } + +/* + * Compares the last strlen(s2) characters of s1 with s2. + * + * Returns as for strcasecmp. + */ +int utils_strcasecmpend(const char *s1, const char *s2) +{ + size_t n1 = strlen(s1), n2 = strlen(s2); + + if (n2 > n1) { + /* Then they can't be the same; figure out which is bigger */ + return strcasecmp(s1, s2); + } else { + return strncasecmp(s1 + (n1 - n2), s2, n2); + } +} diff --git a/src/common/utils.h b/src/common/utils.h index f6a25e9..aeda872 100644 --- a/src/common/utils.h +++ b/src/common/utils.h @@ -23,6 +23,7 @@ #include <netinet/in.h> char *utils_strsplit(char *separator, char **text, const char *search); +int utils_strcasecmpend(const char *s1, const char *s2); int utils_tokenize_ignore_comments(const char *_line, size_t size, char **tokens); int utils_is_address_ipv4(const char *ip); diff --git a/src/lib/connect.c b/src/lib/connect.c index cee4d76..6ab2a82 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -21,6 +21,7 @@ #include <common/connection.h> #include <common/log.h> +#include <common/onion.h> #include "torsocks.h" @@ -32,6 +33,8 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) int ret, sock_type; socklen_t optlen; struct connection *new_conn; + struct onion_entry *on_entry; + struct sockaddr_in *inet_addr; DBG("Connect catched on fd %d", __sockfd); @@ -61,6 +64,8 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) DBG("[connect] Socket family %s and type %d", __addr->sa_family == AF_INET ? "AF_INET" : "AF_INET6", sock_type); + inet_addr = (struct sockaddr_in *) __addr; + /* * Lock registry to get the connection reference if one. In this code path, * if a connection object is found, it will not be used since a double @@ -76,10 +81,34 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) goto error; } - new_conn = connection_create(__sockfd, __addr); - if (!new_conn) { - errno = ENOMEM; - goto error; + /* + * See if the IP being connected is an onion IP cookie mapping to an + * existing .onion address. + */ + onion_pool_lock(&tsocks_onion_pool); + on_entry = onion_entry_find_by_ip(inet_addr->sin_addr.s_addr, + &tsocks_onion_pool); + onion_pool_unlock(&tsocks_onion_pool); + + if (on_entry) { + /* + * Create a connection without a destination address since we will set + * the onion address name found before. + */ + new_conn = connection_create(__sockfd, NULL); + if (!new_conn) { + errno = ENOMEM; + goto error; + } + new_conn->dest_addr.domain = CONNECTION_DOMAIN_NAME; + new_conn->dest_addr.hostname.addr = strdup(on_entry->hostname); + new_conn->dest_addr.hostname.port = inet_addr->sin_port; + } else { + new_conn = connection_create(__sockfd, __addr); + if (!new_conn) { + errno = ENOMEM; + goto error; + } } /* Connect the socket to the Tor network. */ diff --git a/src/lib/torsocks.c b/src/lib/torsocks.c index bc5959a..f40de3c 100644 --- a/src/lib/torsocks.c +++ b/src/lib/torsocks.c @@ -26,7 +26,9 @@ #include <common/connection.h> #include <common/defaults.h> #include <common/log.h> +#include <common/onion.h> #include <common/socks5.h> +#include <common/utils.h> #include "torsocks.h" @@ -39,6 +41,13 @@ struct configuration tsocks_config; /* + * This is the onion address pool for the library. It is initialized once in + * the constructor. This object changes over time and every access is nested + * inside the registry lock. + */ +struct onion_pool tsocks_onion_pool; + +/* * Set to 1 if the binary is set with suid or 0 if not. This is set once during * initialization so after that it can be read without any protection. */ @@ -87,6 +96,10 @@ static void init_config(void) if (tsocks_config.conf_file.tor_domain == 0) { tsocks_config.conf_file.tor_domain = DEFAULT_TOR_DOMAIN; } + if (tsocks_config.conf_file.onion_base == 0) { + tsocks_config.conf_file.onion_base = inet_addr(DEFAULT_ONION_ADDR_RANGE); + tsocks_config.conf_file.onion_mask = atoi(DEFAULT_ONION_ADDR_MASK); + } /* Create the Tor SOCKS5 connection address. */ ret = connection_addr_set(tsocks_config.conf_file.tor_domain, @@ -160,6 +173,8 @@ static void init_logging(void) */ static void __attribute__((constructor)) tsocks_init(void) { + int ret; + /* UID and effective UID MUST be the same or else we are SUID. */ is_suid = (getuid() != geteuid()); @@ -178,6 +193,17 @@ static void __attribute__((constructor)) tsocks_init(void) /* Initialize connection reigstry. */ connection_registry_init(); + + /* + * Initalized the onion pool which maps cookie address to hidden service + * onion address. + */ + ret = onion_pool_init(&tsocks_onion_pool, + tsocks_config.conf_file.onion_base, + tsocks_config.conf_file.onion_mask); + if (ret < 0) { + clean_exit(EXIT_FAILURE); + } } /* @@ -185,6 +211,8 @@ static void __attribute__((constructor)) tsocks_init(void) */ static void __attribute__((destructor)) tsocks_exit(void) { + /* Cleanup every entries in the onion pool. */ + onion_pool_destroy(&tsocks_onion_pool); /* Cleanup allocated memory in the config file. */ config_file_destroy(&tsocks_config.conf_file); /* Clean up logging. */ @@ -224,6 +252,45 @@ error: } /* + * Lookup by hostname for an onion entry in a given pool. The entry is returned + * if found or else a new one is created, added to the pool and finally + * returned. + * + * NOTE: The pool lock MUST NOT be acquired before calling this. + * + * On success the entry is returned else a NULL value. + */ +static struct onion_entry *get_onion_entry(const char *hostname, + struct onion_pool *pool) +{ + struct onion_entry *entry = NULL; + + assert(hostname); + assert(pool); + + tsocks_mutex_lock(&pool->lock); + + entry = onion_entry_find_by_name(hostname, pool); + if (entry) { + goto end; + } + + /* + * On success, the onion entry is automatically added to the onion pool and + * the reference is returned. + */ + entry = onion_entry_create(pool, hostname); + if (!entry) { + goto error; + } + +end: +error: + tsocks_mutex_unlock(&pool->lock); + return entry; +} + +/* * Initiate a SOCK5 connection to the Tor network using the given connection. * The socks5 API will use the torsocks configuration object to find the tor * daemon. @@ -273,6 +340,22 @@ int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) DBG("Resolving %s on the Tor network", hostname); + /* + * Tor hidden service address have no IP address so we send back an onion + * reserved IP address that acts as a cookie that we will use to find the + * onion hostname at the connect() stage. + */ + if (utils_strcasecmpend(hostname, ".onion") == 0) { + struct onion_entry *entry; + + entry = get_onion_entry(hostname, &tsocks_onion_pool); + if (entry) { + memcpy(ip_addr, &entry->ip, sizeof(entry->ip)); + ret = 0; + goto end; + } + } + conn.fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); if (conn.fd < 0) { PERROR("socket"); @@ -301,6 +384,7 @@ int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) PERROR("close"); } +end: error: return ret; } diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 2e6fd50..2d40470 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -143,6 +143,9 @@ enum tsocks_sym_action { /* Global configuration. Initialized once in the library constructor. */ extern struct configuration tsocks_config; +/* Global pool for .onion address. Initialized once in the constructor. */ +extern struct onion_pool tsocks_onion_pool; + int tsocks_connect_to_tor(struct connection *conn); void *tsocks_find_libc_symbol(const char *symbol, enum tsocks_sym_action action);

1 0

[torsocks/master] Add support for gethostbyaddr_r(3)
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 450abaddbef2b51ca4b845e6ad86c89051ab17d2 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Jul 15 01:57:33 2013 -0400 Add support for gethostbyaddr_r(3) Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/gethostbyname.c | 195 +++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.h | 16 ++++ 2 files changed, 211 insertions(+) diff --git a/src/lib/gethostbyname.c b/src/lib/gethostbyname.c index 3e89e9b..af47e73 100644 --- a/src/lib/gethostbyname.c +++ b/src/lib/gethostbyname.c @@ -26,6 +26,98 @@ #include "torsocks.h" /* + * Free the given hostent structure and all pointers contained inside. + */ +static void free_hostent(struct hostent *he) +{ + if (!he) { + return; + } + + if (he->h_name) { + free(he->h_name); + } + + if (he->h_aliases) { + int i = 0; + + while (he->h_aliases[i] != NULL) { + free(he->h_aliases[i]); + i++; + } + } + + if (he->h_addr_list) { + int i = 0; + + while (he->h_addr_list[i] != NULL) { + free(he->h_addr_list[i]); + i++; + } + } + + free(he); +} + +/* + * Allocate a hostent structure with the given type. + * + * On error, return NULL. + */ +static struct hostent *alloc_hostent(int af) +{ + void *addr = NULL; + char **addr_list = NULL, **aliases = NULL; + struct hostent *he = NULL; + size_t addrlen; + + if (af != AF_INET && af != AF_INET6) { + goto error; + } + + he = zmalloc(sizeof(*he)); + addr_list = zmalloc(sizeof(*addr_list) * 2); + aliases = zmalloc(sizeof(*aliases)); + if (!he || !addr_list || !aliases) { + PERROR("zmalloc hostent"); + goto error; + } + + switch (af) { + case AF_INET: + addr = zmalloc(sizeof(struct in_addr)); + addrlen = sizeof(struct in_addr); + break; + case AF_INET6: + addr = zmalloc(sizeof(struct in6_addr)); + addrlen = sizeof(struct in6_addr); + break; + default: + assert(0); + goto error; + } + if (!addr) { + PERROR("zmalloc addr"); + goto error; + } + + he->h_name = NULL; + he->h_addr_list = addr_list; + he->h_addr_list[0] = addr; + he->h_addr_list[1] = NULL; + he->h_aliases = aliases; + he->h_aliases[0] = NULL; + he->h_length = addrlen; + he->h_addrtype = af; + + return he; + +error: + free_hostent(he); + return NULL; +} + +/* * Torsocks call for gethostbyname(3). * * NOTE: This call is OBSOLETE in the glibc. @@ -179,3 +271,106 @@ LIBC_GETHOSTBYADDR_DECL { return tsocks_gethostbyaddr(LIBC_GETHOSTBYADDR_ARGS); } + +/* + * Torsocks call for gethostbyaddr_r(3). + * + * NOTE: GNU extension. Reentrant version. + */ +LIBC_GETHOSTBYADDR_R_RET_TYPE tsocks_gethostbyaddr_r(LIBC_GETHOSTBYADDR_R_SIG) +{ + int ret; + struct hostent *he = NULL; + + struct data { + char *hostname; + char *addr_list[2]; + char padding[]; + } *data; + + if (__buflen < sizeof(struct data)) { + ret = ERANGE; + goto error; + } + data = (struct data *) __buf; + memset(data, 0, sizeof(*data)); + + /* + * Tor does not allow to resolve to an IPv6 pointer so only accept inet + * return address. + */ + if (!__addr || __type != AF_INET) { + ret = HOST_NOT_FOUND; + if (__h_errnop) { + *__h_errnop = HOST_NOT_FOUND; + } + goto error; + } + + DBG("[gethostbyaddr_r] Requesting address %s of len %d and type %d", + inet_ntoa(*((struct in_addr *) __addr)), __len, __type); + + /* This call allocates hostname. On error, it's untouched. */ + ret = tsocks_tor_resolve_ptr(__addr, &data->hostname, __type); + if (ret < 0) { + const char *ret_str; + + ret_str = inet_ntop(__type, __addr, __buf, __buflen); + if (!ret_str) { + ret = HOST_NOT_FOUND; + if (errno == ENOSPC) { + ret = ERANGE; + } + if (__h_errnop) { + *__h_errnop = HOST_NOT_FOUND; + } + goto error; + } + } + + /* Ease our life a bit. */ + he = __ret; + + if (!he) { + ret = NO_RECOVERY; + if (__h_errnop) { + *__h_errnop = NO_RECOVERY; + } + goto error; + } + + if (data->hostname) { + he->h_name = data->hostname; + } else { + ret = NO_RECOVERY; + if (__h_errnop) { + *__h_errnop = NO_RECOVERY; + } + goto error; + } + + he->h_aliases = NULL; + he->h_length = strlen(he->h_name); + /* Assign the address list within the data of the given buffer. */ + data->addr_list[0] = (char *) __addr; + data->addr_list[1] = NULL; + he->h_addr_list = data->addr_list; + + if (__result) { + *__result = he; + } + + /* Everything went good. */ + ret = 0; + +error: + return ret; +} + +/* + * Libc hijacked symbol gethostbyaddr_r(3). + */ +LIBC_GETHOSTBYADDR_R_DECL +{ + return tsocks_gethostbyaddr_r(LIBC_GETHOSTBYADDR_R_ARGS); +} diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 4acacff..3cd51d0 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -90,6 +90,16 @@ char tsocks_he_name[255]; #define LIBC_GETHOSTBYADDR_SIG const void *__addr, socklen_t __len, int __type #define LIBC_GETHOSTBYADDR_ARGS __addr, __len, __type +/* GNU extension. Reentrant version. */ +#define LIBC_GETHOSTBYADDR_R_NAME gethostbyaddr_r +#define LIBC_GETHOSTBYADDR_R_NAME_STR XSTR(LIBC_GETHOSTBYADDR_R_NAME) +#define LIBC_GETHOSTBYADDR_R_RET_TYPE int +#define LIBC_GETHOSTBYADDR_R_SIG const void *__addr, socklen_t __len, int __type, \ + struct hostent *__ret, char *__buf, size_t __buflen, \ + struct hostent **__result, int *__h_errnop +#define LIBC_GETHOSTBYADDR_R_ARGS __addr, __len, __type, __ret, __buf, \ + __buflen, __result, __h_errnop + /* getaddrinfo(3) */ #include <netdb.h> @@ -138,6 +148,12 @@ TSOCKS_LIBC_DECL(gethostbyaddr, LIBC_GETHOSTBYADDR_RET_TYPE, #define LIBC_GETHOSTBYADDR_DECL LIBC_GETHOSTBYADDR_RET_TYPE \ LIBC_GETHOSTBYADDR_NAME(LIBC_GETHOSTBYADDR_SIG) +/* gethostbyaddr_r(3) */ +TSOCKS_LIBC_DECL(gethostbyaddr_r, LIBC_GETHOSTBYADDR_R_RET_TYPE, + LIBC_GETHOSTBYADDR_R_SIG) +#define LIBC_GETHOSTBYADDR_R_DECL LIBC_GETHOSTBYADDR_R_RET_TYPE \ + LIBC_GETHOSTBYADDR_R_NAME(LIBC_GETHOSTBYADDR_R_SIG) + /* getaddrinfo(3) */ TSOCKS_LIBC_DECL(getaddrinfo, LIBC_GETADDRINFO_RET_TYPE, LIBC_GETADDRINFO_SIG)

1 0

[torsocks/master] Add reentrant functions gethostby*
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit c4f9f73a392b9f360d3a2b25e9ac5607e2b83230 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Tue Aug 6 08:05:30 2013 -0400 Add reentrant functions gethostby* Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/gethostbyname.c | 111 +++++++++++++++++++++++++++++++++++++++++++++-- src/lib/torsocks.h | 32 ++++++++++++++ 2 files changed, 140 insertions(+), 3 deletions(-) diff --git a/src/lib/gethostbyname.c b/src/lib/gethostbyname.c index af47e73..87dace1 100644 --- a/src/lib/gethostbyname.c +++ b/src/lib/gethostbyname.c @@ -1,7 +1,7 @@ /* - * Copyright (C) 2000-2008 - Shaun Clowes <delius(a)progsoc.org> - * 2008-2011 - Robert Hogan <robert(a)roberthogan.net> - * 2013 - David Goulet <dgoulet(a)ev0ke.net> + * Copyright (C) 2000-2008 - Shaun Clowes <delius(a)progsoc.org> 2008-2011 - + * Robert Hogan <robert(a)roberthogan.net> 2013 - David Goulet + * <dgoulet(a)ev0ke.net> * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License, version 2 only, as @@ -374,3 +374,108 @@ LIBC_GETHOSTBYADDR_R_DECL { return tsocks_gethostbyaddr_r(LIBC_GETHOSTBYADDR_R_ARGS); } + +/* + * Torsocks call for gethostbyname(3). + * + * NOTE: GNU extension. Reentrant version. + */ +LIBC_GETHOSTBYNAME_R_RET_TYPE tsocks_gethostbyname_r(LIBC_GETHOSTBYNAME_R_SIG) +{ + int ret; + /* This call is always using AF_INET. */ + uint32_t ip; + const char *ret_str; + struct hostent *he = NULL; + + struct data { + char addr[INET_ADDRSTRLEN]; + char *addr_list[2]; + char padding[]; + } *data; + + DBG("[gethostbyname_r] Requesting %s hostname", __name); + + if (!__name) { + *__h_errnop = HOST_NOT_FOUND; + ret = -1; + goto error; + } + + if (__buflen < sizeof(*data)) { + ret = ERANGE; + goto error; + } + + /* Resolve the given hostname through Tor. */ + ret = tsocks_tor_resolve(__name, &ip); + if (ret < 0) { + goto error; + } + + data = (struct data *) __buf; + memset(data, 0, sizeof(*data)); + /* Ease our life a bit. */ + he = __ret; + + ret_str = inet_ntop(AF_INET, &ip, data->addr, sizeof(data->addr)); + if (!ret_str) { + PERROR("inet_ntop"); + *__h_errnop = NO_ADDRESS; + goto error; + } + + memcpy(data->addr, &ip, sizeof(ip)); + data->addr_list[0] = data->addr; + data->addr_list[1] = NULL; + he->h_addr_list = data->addr_list; + + he->h_name = (char *) __name; + he->h_aliases = NULL; + he->h_length = sizeof(in_addr_t); + he->h_addrtype = AF_INET; + + DBG("[gethostbyname_r] Hostname %s resolved to %s", __name, + inet_ntoa(*((struct in_addr *) &ip))); + +error: + return ret; +} + +/* + * Libc hijacked symbol gethostbyname_r(3). + */ +LIBC_GETHOSTBYNAME_R_DECL +{ + return tsocks_gethostbyname_r(LIBC_GETHOSTBYNAME_R_ARGS); +} + +/* + * Torsocks call for gethostbyname(3). + * + * NOTE: GNU extension. Reentrant version. + */ +LIBC_GETHOSTBYNAME2_R_RET_TYPE tsocks_gethostbyname2_r(LIBC_GETHOSTBYNAME2_R_SIG) +{ + DBG("[gethostbyname2_r] Requesting %s hostname", __name); + + /* + * For now, there is no way of resolving a domain name to IPv6 through Tor + * so only accept INET request thus using the original gethostbyname(). + */ + if (__af != AF_INET) { + *__h_errnop = HOST_NOT_FOUND; + return -1; + } + + return tsocks_gethostbyname_r(__name, __ret, __buf, __buflen, __result, + __h_errnop); +} + +/* + * Libc hijacked symbol gethostbyname2_r(3). + */ +LIBC_GETHOSTBYNAME2_R_DECL +{ + return tsocks_gethostbyname2_r(LIBC_GETHOSTBYNAME2_R_ARGS); +} diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 55d46d6..f1a93ef 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -81,6 +81,26 @@ char tsocks_he_name[255]; #define LIBC_GETHOSTBYNAME2_SIG const char *__name, int __af #define LIBC_GETHOSTBYNAME2_ARGS __name, __af +/* GNU extension. Reentrant version. */ +#define LIBC_GETHOSTBYNAME_R_NAME gethostbyname_r +#define LIBC_GETHOSTBYNAME_R_NAME_STR XSTR(LIBC_GETHOSTBYNAME_R_NAME) +#define LIBC_GETHOSTBYNAME_R_RET_TYPE int +#define LIBC_GETHOSTBYNAME_R_SIG const char *__name, \ + struct hostent *__ret, char *__buf, size_t __buflen, \ + struct hostent **__result, int *__h_errnop +#define LIBC_GETHOSTBYNAME_R_ARGS __name, __ret, __buf, \ + __buflen, __result, __h_errnop + +/* GNU extension. Reentrant version 2. */ +#define LIBC_GETHOSTBYNAME2_R_NAME gethostbyname2_r +#define LIBC_GETHOSTBYNAME2_R_NAME_STR XSTR(LIBC_GETHOSTBYNAME2_R_NAME) +#define LIBC_GETHOSTBYNAME2_R_RET_TYPE int +#define LIBC_GETHOSTBYNAME2_R_SIG const char *__name, int __af, \ + struct hostent *__ret, char *__buf, size_t __buflen, \ +struct hostent **__result, int *__h_errnop +#define LIBC_GETHOSTBYNAME2_R_ARGS __name, __af, __ret, __buf, \ + __buflen, __result, __h_errnop + /* gethostbyaddr(3) - DEPRECATED in glibc. */ #include <sys/socket.h> @@ -146,12 +166,24 @@ TSOCKS_LIBC_DECL(gethostbyname, LIBC_GETHOSTBYNAME_RET_TYPE, #define LIBC_GETHOSTBYNAME_DECL LIBC_GETHOSTBYNAME_RET_TYPE \ LIBC_GETHOSTBYNAME_NAME(LIBC_GETHOSTBYNAME_SIG) +/* gethostbyname_r(3) */ +TSOCKS_LIBC_DECL(gethostbyname_r, LIBC_GETHOSTBYNAME_R_RET_TYPE, + LIBC_GETHOSTBYNAME_R_SIG) +#define LIBC_GETHOSTBYNAME_R_DECL LIBC_GETHOSTBYNAME_R_RET_TYPE \ + LIBC_GETHOSTBYNAME_R_NAME(LIBC_GETHOSTBYNAME_R_SIG) + /* gethostbyname2(3) */ TSOCKS_LIBC_DECL(gethostbyname2, LIBC_GETHOSTBYNAME2_RET_TYPE, LIBC_GETHOSTBYNAME2_SIG) #define LIBC_GETHOSTBYNAME2_DECL LIBC_GETHOSTBYNAME2_RET_TYPE \ LIBC_GETHOSTBYNAME2_NAME(LIBC_GETHOSTBYNAME2_SIG) +/* gethostbyname2_r(3) */ +TSOCKS_LIBC_DECL(gethostbyname2_r, LIBC_GETHOSTBYNAME2_R_RET_TYPE, + LIBC_GETHOSTBYNAME2_R_SIG) +#define LIBC_GETHOSTBYNAME2_R_DECL LIBC_GETHOSTBYNAME2_R_RET_TYPE \ + LIBC_GETHOSTBYNAME2_R_NAME(LIBC_GETHOSTBYNAME2_R_SIG) + /* gethostbyaddr(3) */ TSOCKS_LIBC_DECL(gethostbyaddr, LIBC_GETHOSTBYADDR_RET_TYPE, LIBC_GETHOSTBYADDR_SIG)

1 0

[torsocks/master] Add close(2) support
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 22fda9910920d7465d1558bd6cf2741177b3b908 Author: David Goulet <dgoulet(a)efficios.com> Date: Sat Jul 6 22:33:14 2013 -0400 Add close(2) support Signed-off-by: David Goulet <dgoulet(a)efficios.com> --- src/lib/Makefile.am | 2 +- src/lib/close.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.c | 2 ++ src/lib/torsocks.h | 14 +++++++++++ 4 files changed, 81 insertions(+), 1 deletion(-) diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index bf9237e..ec9ef0f 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -11,7 +11,7 @@ EXTRA_DIST = torsocks.in usewithtor.in lib_LTLIBRARIES = libtorsocks.la libtorsocks_la_SOURCES = torsocks.c torsocks.h \ - connect.c gethostbyname.c getaddrinfo.c + connect.c gethostbyname.c getaddrinfo.c close.c libtorsocks_la_LIBADD = \ $(top_builddir)/src/common/libcommon.la \ diff --git a/src/lib/close.c b/src/lib/close.c new file mode 100644 index 0000000..699b93c --- /dev/null +++ b/src/lib/close.c @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2013 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <common/connection.h> +#include <common/log.h> + +#include "torsocks.h" + +/* + * Torsocks call for close(2). + */ +LIBC_CLOSE_RET_TYPE tsocks_close(LIBC_CLOSE_SIG) +{ + struct connection *conn; + + DBG("Close catched for fd %d", __fd); + + connection_registry_lock(); + conn = connection_find(__fd); + if (conn) { + /* + * Remove from the registry so it's not visible anymore and thus using + * it without lock. + */ + connection_remove(conn); + } + connection_registry_unlock(); + + /* + * Put back the connection reference. If the refcount get to 0, the + * connection pointer is destroyed. + */ + if (conn) { + DBG("Close connection putting back ref"); + connection_put_ref(conn); + } + + /* Return the original libc close. */ + return tsocks_libc_close(__fd); +} + +/* + * Libc hijacked symbol close(2). + */ +LIBC_CLOSE_DECL +{ + tsocks_libc_close = tsocks_find_libc_symbol(LIBC_CLOSE_NAME_STR, + TSOCKS_SYM_EXIT_NOT_FOUND); + return tsocks_close(LIBC_CLOSE_ARGS); +} diff --git a/src/lib/torsocks.c b/src/lib/torsocks.c index f40de3c..cf287d9 100644 --- a/src/lib/torsocks.c +++ b/src/lib/torsocks.c @@ -121,6 +121,8 @@ static void init_libc_symbols(void) { tsocks_libc_connect = tsocks_find_libc_symbol(LIBC_CONNECT_NAME_STR, TSOCKS_SYM_EXIT_NOT_FOUND); + tsocks_libc_close = tsocks_find_libc_symbol(LIBC_CLOSE_NAME_STR, + TSOCKS_SYM_EXIT_NOT_FOUND); } /* diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 2d40470..4acacff 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -45,6 +45,15 @@ #define LIBC_CONNECT_ARGS \ __sockfd, __addr, __addrlen +/* close(2) */ +#include <unistd.h> + +#define LIBC_CLOSE_NAME close +#define LIBC_CLOSE_NAME_STR XSTR(LIBC_CLOSE_NAME) +#define LIBC_CLOSE_RET_TYPE int +#define LIBC_CLOSE_SIG int __fd +#define LIBC_CLOSE_ARGS __fd + /* gethostbyname(3) - DEPRECATED in glibc. */ #include <netdb.h> @@ -106,6 +115,11 @@ TSOCKS_LIBC_DECL(connect, LIBC_CONNECT_RET_TYPE, LIBC_CONNECT_SIG) #define LIBC_CONNECT_DECL \ LIBC_CONNECT_RET_TYPE LIBC_CONNECT_NAME(LIBC_CONNECT_SIG) +/* close(2) */ +TSOCKS_LIBC_DECL(close, LIBC_CLOSE_RET_TYPE, LIBC_CLOSE_SIG) +#define LIBC_CLOSE_DECL \ + LIBC_CLOSE_RET_TYPE LIBC_CLOSE_NAME(LIBC_CLOSE_SIG) + /* gethostbyname(3) */ TSOCKS_LIBC_DECL(gethostbyname, LIBC_GETHOSTBYNAME_RET_TYPE, LIBC_GETHOSTBYNAME_SIG)

1 0

[torsocks/master] Fix: add missing optlen assignement in connect
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 70f79ab4350692f5f120ef216c507ab9f2a871de Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Aug 5 11:58:46 2013 -0400 Fix: add missing optlen assignement in connect Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/connect.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lib/connect.c b/src/lib/connect.c index 6ab2a82..6d84cc8 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -38,6 +38,7 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) DBG("Connect catched on fd %d", __sockfd); + optlen = sizeof(sock_type); ret = getsockopt(__sockfd, SOL_SOCKET, SO_TYPE, &sock_type, &optlen); if (ret < 0) { /* Use the getsockopt() errno value. */

1 0

[torsocks/master] Fix: add missing include in header
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 535871383c146a1b23a3d75fe77189a0b5b8c110 Author: David Goulet <dgoulet(a)efficios.com> Date: Sat Jul 6 22:32:55 2013 -0400 Fix: add missing include in header Signed-off-by: David Goulet <dgoulet(a)efficios.com> --- src/common/ref.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/common/ref.h b/src/common/ref.h index e1ae6d9..aa0cc90 100644 --- a/src/common/ref.h +++ b/src/common/ref.h @@ -18,6 +18,8 @@ #ifndef TORSOCKS_REF_H #define TORSOCKS_REF_H +#include <assert.h> + struct ref { long count; };

1 0

[torsocks/master] Update TODO for this rewrite
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 79003cf34c41d41318b04ed5ff67476ba31c1490 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Sat Jul 6 22:41:56 2013 -0400 Update TODO for this rewrite Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- TODO | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/TODO b/TODO index 285b1a7..0132c79 100644 --- a/TODO +++ b/TODO @@ -1,3 +1,13 @@ +Version 2.0 +----------- +* sendmsg()/sendto() --> Deny UDP packet since it might be a DNS request. +* Complete gethostby* family function +* Support res_* API +* Get sendmsg FD passing on Unix socket and for TCP socket, clean exit +* Support getpeername() since some programs use that to check if a socket +is already connected. +* Deny ICMP + Version 1.0 -----------

1 0

[torsocks/master] Add socket(2) support
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit fe4e8981364ebb1d677cbdcc0302bafbce345d3b Author: David Goulet <dgoulet(a)ev0ke.net> Date: Wed Aug 7 06:07:11 2013 -0400 Add socket(2) support Deny every non TCP socket that are inet/inet6 domain because we can't pipe that data to the Tor network. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/Makefile.am | 2 +- src/lib/socket.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.c | 6 ++++-- src/lib/torsocks.h | 14 +++++++++++++ 4 files changed, 74 insertions(+), 3 deletions(-) diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index f27db5c..d107fc8 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -12,7 +12,7 @@ lib_LTLIBRARIES = libtorsocks.la libtorsocks_la_SOURCES = torsocks.c torsocks.h \ connect.c gethostbyname.c getaddrinfo.c close.c \ - getpeername.c + getpeername.c socket.c libtorsocks_la_LIBADD = \ $(top_builddir)/src/common/libcommon.la \ diff --git a/src/lib/socket.c b/src/lib/socket.c new file mode 100644 index 0000000..69d28e6 --- /dev/null +++ b/src/lib/socket.c @@ -0,0 +1,55 @@ +/* + * Copyright (C) 2013 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <assert.h> + +#include <common/log.h> + +#include "torsocks.h" + +/* + * Torsocks call for socket(2) + */ +LIBC_SOCKET_RET_TYPE tsocks_socket(LIBC_SOCKET_SIG) +{ + switch (__type) { + case SOCK_STREAM: + break; + default: + if (__domain == AF_INET || __domain == AF_INET6) { + ERR("Non TCP socket denied. Tor network can't handle it. " + "Stopping everything!"); + errno = EINVAL; + return -1; + } + break; + } + + /* Stream socket for INET/INET6 is good so open it. */ + return tsocks_libc_socket(__domain, __type, __protocol); +} + +/* + * Libc hijacked symbol socket(2). + */ +LIBC_SOCKET_DECL +{ + /* Find symbol if not already set. Exit if not found. */ + tsocks_libc_socket = tsocks_find_libc_symbol(LIBC_SOCKET_NAME_STR, + TSOCKS_SYM_EXIT_NOT_FOUND); + return tsocks_socket(LIBC_SOCKET_ARGS); +} diff --git a/src/lib/torsocks.c b/src/lib/torsocks.c index cf287d9..833a472 100644 --- a/src/lib/torsocks.c +++ b/src/lib/torsocks.c @@ -123,6 +123,8 @@ static void init_libc_symbols(void) TSOCKS_SYM_EXIT_NOT_FOUND); tsocks_libc_close = tsocks_find_libc_symbol(LIBC_CLOSE_NAME_STR, TSOCKS_SYM_EXIT_NOT_FOUND); + tsocks_libc_socket = tsocks_find_libc_symbol(LIBC_SOCKET_NAME_STR, + TSOCKS_SYM_EXIT_NOT_FOUND); } /* @@ -358,7 +360,7 @@ int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) } } - conn.fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); + conn.fd = tsocks_libc_socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); if (conn.fd < 0) { PERROR("socket"); ret = -errno; @@ -406,7 +408,7 @@ int tsocks_tor_resolve_ptr(const char *addr, char **ip, int af) DBG("Resolving %" PRIu32 " on the Tor network", addr); - conn.fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); + conn.fd = tsocks_libc_socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); if (conn.fd < 0) { PERROR("socket"); ret = -errno; diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index f1a93ef..b8da8ca 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -45,6 +45,15 @@ #define LIBC_CONNECT_ARGS \ __sockfd, __addr, __addrlen +/* socket(2) */ +#define LIBC_SOCKET_NAME socket +#define LIBC_SOCKET_NAME_STR XSTR(LIBC_SOCKET_NAME) +#define LIBC_SOCKET_RET_TYPE int +#define LIBC_SOCKET_SIG \ + int __domain, int __type, int __protocol +#define LIBC_SOCKET_ARGS \ + __domain, __type, __protocol + /* close(2) */ #include <unistd.h> @@ -155,6 +164,11 @@ TSOCKS_LIBC_DECL(connect, LIBC_CONNECT_RET_TYPE, LIBC_CONNECT_SIG) #define LIBC_CONNECT_DECL \ LIBC_CONNECT_RET_TYPE LIBC_CONNECT_NAME(LIBC_CONNECT_SIG) +/* socket(2) */ +TSOCKS_LIBC_DECL(socket, LIBC_SOCKET_RET_TYPE, LIBC_SOCKET_SIG) +#define LIBC_SOCKET_DECL \ + LIBC_SOCKET_RET_TYPE LIBC_SOCKET_NAME(LIBC_SOCKET_SIG) + /* close(2) */ TSOCKS_LIBC_DECL(close, LIBC_CLOSE_RET_TYPE, LIBC_CLOSE_SIG) #define LIBC_CLOSE_DECL \

1 0

[torsocks/master] Remove unused code
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 0168b19a39bc20180d72bf21dd5b22c096244dee Author: David Goulet <dgoulet(a)ev0ke.net> Date: Wed Aug 7 08:10:37 2013 -0400 Remove unused code Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/gethostbyname.c | 92 ----------------------------------------------- 1 file changed, 92 deletions(-) diff --git a/src/lib/gethostbyname.c b/src/lib/gethostbyname.c index 87dace1..3e3588e 100644 --- a/src/lib/gethostbyname.c +++ b/src/lib/gethostbyname.c @@ -26,98 +26,6 @@ #include "torsocks.h" /* - * Free the given hostent structure and all pointers contained inside. - */ -static void free_hostent(struct hostent *he) -{ - if (!he) { - return; - } - - if (he->h_name) { - free(he->h_name); - } - - if (he->h_aliases) { - int i = 0; - - while (he->h_aliases[i] != NULL) { - free(he->h_aliases[i]); - i++; - } - } - - if (he->h_addr_list) { - int i = 0; - - while (he->h_addr_list[i] != NULL) { - free(he->h_addr_list[i]); - i++; - } - } - - free(he); -} - -/* - * Allocate a hostent structure with the given type. - * - * On error, return NULL. - */ -static struct hostent *alloc_hostent(int af) -{ - void *addr = NULL; - char **addr_list = NULL, **aliases = NULL; - struct hostent *he = NULL; - size_t addrlen; - - if (af != AF_INET && af != AF_INET6) { - goto error; - } - - he = zmalloc(sizeof(*he)); - addr_list = zmalloc(sizeof(*addr_list) * 2); - aliases = zmalloc(sizeof(*aliases)); - if (!he || !addr_list || !aliases) { - PERROR("zmalloc hostent"); - goto error; - } - - switch (af) { - case AF_INET: - addr = zmalloc(sizeof(struct in_addr)); - addrlen = sizeof(struct in_addr); - break; - case AF_INET6: - addr = zmalloc(sizeof(struct in6_addr)); - addrlen = sizeof(struct in6_addr); - break; - default: - assert(0); - goto error; - } - if (!addr) { - PERROR("zmalloc addr"); - goto error; - } - - he->h_name = NULL; - he->h_addr_list = addr_list; - he->h_addr_list[0] = addr; - he->h_addr_list[1] = NULL; - he->h_aliases = aliases; - he->h_aliases[0] = NULL; - he->h_length = addrlen; - he->h_addrtype = af; - - return he; - -error: - free_hostent(he); - return NULL; -} - -/* * Torsocks call for gethostbyname(3). * * NOTE: This call is OBSOLETE in the glibc.

1 0

[torsocks/master] Add syscall(2) support
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit ce460ba3e9931a5ab8d7f27c9dc46eb325bcbf07 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Wed Aug 7 08:01:28 2013 -0400 Add syscall(2) support At this commit, only close, connect and socket are handled through syscall(2). Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/Makefile.am | 2 +- src/lib/socket.c | 3 ++ src/lib/syscall.c | 111 +++++++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.h | 25 ++++++++++++ 4 files changed, 140 insertions(+), 1 deletion(-) diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index d107fc8..0f764f1 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -12,7 +12,7 @@ lib_LTLIBRARIES = libtorsocks.la libtorsocks_la_SOURCES = torsocks.c torsocks.h \ connect.c gethostbyname.c getaddrinfo.c close.c \ - getpeername.c socket.c + getpeername.c socket.c syscall.c libtorsocks_la_LIBADD = \ $(top_builddir)/src/common/libcommon.la \ diff --git a/src/lib/socket.c b/src/lib/socket.c index 69d28e6..1f543e5 100644 --- a/src/lib/socket.c +++ b/src/lib/socket.c @@ -26,6 +26,9 @@ */ LIBC_SOCKET_RET_TYPE tsocks_socket(LIBC_SOCKET_SIG) { + DBG("[socket] Creating socket with domain %d, type %d and protocol %d", + __domain, __type, __protocol); + switch (__type) { case SOCK_STREAM: break; diff --git a/src/lib/syscall.c b/src/lib/syscall.c new file mode 100644 index 0000000..5cb9e8f --- /dev/null +++ b/src/lib/syscall.c @@ -0,0 +1,111 @@ +/* + * Copyright (C) 2013 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <assert.h> +#include <stdarg.h> + +#include <common/log.h> + +#include "torsocks.h" + +/* + * Handle close syscall to be called with tsocks call. + */ +static LIBC_CLOSE_RET_TYPE handle_close(va_list args) +{ + int fd; + + fd = va_arg(args, int); + + return tsocks_close(fd); +} + +/* + * Handle socket syscall to go through Tor. + */ +static LIBC_SOCKET_RET_TYPE handle_socket(va_list args) +{ + int domain, type, protocol; + + domain = va_arg(args, int); + type = va_arg(args, int); + protocol = va_arg(args, int); + + return tsocks_socket(domain, type, protocol); +} + +/* + * Handle connect syscall to go through Tor. + */ +static LIBC_CONNECT_RET_TYPE handle_connect(va_list args) +{ + int sockfd; + const struct sockaddr *addr; + socklen_t addrlen; + + sockfd = va_arg(args, int); + addr = va_arg(args, const struct sockaddr *); + addrlen = va_arg(args, socklen_t); + + return tsocks_connect(sockfd, addr, addrlen); +} + +/* + * Torsocks call for syscall(2) + */ +LIBC_SYSCALL_RET_TYPE tsocks_syscall(long int __number, va_list args) +{ + long int ret; + + DBG("[syscall] Syscall libc wrapper number %ld called", __number); + + switch (__number) { + case __NR_socket: + ret = handle_socket(args); + break; + case __NR_connect: + ret = handle_connect(args); + break; + case __NR_close: + ret = handle_close(args); + break; + default: + ret = tsocks_libc_syscall(__number, args); + break; + } + + return ret; +} + +/* + * Libc hijacked symbol syscall(2). + */ +LIBC_SYSCALL_DECL +{ + LIBC_SYSCALL_RET_TYPE ret; + va_list args; + + /* Find symbol if not already set. Exit if not found. */ + tsocks_libc_syscall = tsocks_find_libc_symbol(LIBC_SYSCALL_NAME_STR, + TSOCKS_SYM_EXIT_NOT_FOUND); + + va_start(args, __number); + ret = tsocks_syscall(__number, args); + va_end(args); + + return ret; +} diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index b8da8ca..c6191e2 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -30,6 +30,8 @@ */ #define TSOCKS_LIBC_DECL(name, type, sig) \ type (*tsocks_libc_##name)(sig); +#define TSOCKS_DECL(name, type, sig) \ + extern type tsocks_##name(sig); #if (defined(__linux__) || defined(__FreeBSD__) || defined(__darwin__)) @@ -154,6 +156,21 @@ struct hostent **__result, int *__h_errnop #error "OS not supported." #endif /* __linux__ , __FreeBSD__, __darwin__ */ +#if (defined(__linux__)) + +#define _GNU_SOURCE +#include <unistd.h> +#include <sys/syscall.h> + +/* syscall(2) */ +#define LIBC_SYSCALL_NAME syscall +#define LIBC_SYSCALL_NAME_STR XSTR(LIBC_SYSCALL_NAME) +#define LIBC_SYSCALL_RET_TYPE long int +#define LIBC_SYSCALL_SIG long int __number, ... +#define LIBC_SYSCALL_ARGS __number + +#endif /* __linux__ */ + /* * The following defines are libc function declarations using the macros * defined above on a per OS basis. @@ -161,16 +178,24 @@ struct hostent **__result, int *__h_errnop /* connect(2) */ TSOCKS_LIBC_DECL(connect, LIBC_CONNECT_RET_TYPE, LIBC_CONNECT_SIG) +TSOCKS_DECL(connect, LIBC_CONNECT_RET_TYPE, LIBC_CONNECT_SIG) #define LIBC_CONNECT_DECL \ LIBC_CONNECT_RET_TYPE LIBC_CONNECT_NAME(LIBC_CONNECT_SIG) /* socket(2) */ TSOCKS_LIBC_DECL(socket, LIBC_SOCKET_RET_TYPE, LIBC_SOCKET_SIG) +TSOCKS_DECL(socket, LIBC_SOCKET_RET_TYPE, LIBC_SOCKET_SIG) #define LIBC_SOCKET_DECL \ LIBC_SOCKET_RET_TYPE LIBC_SOCKET_NAME(LIBC_SOCKET_SIG) +/* syscall(2) */ +TSOCKS_LIBC_DECL(syscall, LIBC_SYSCALL_RET_TYPE, LIBC_SYSCALL_SIG) +#define LIBC_SYSCALL_DECL \ + LIBC_SYSCALL_RET_TYPE LIBC_SYSCALL_NAME(LIBC_SYSCALL_SIG) + /* close(2) */ TSOCKS_LIBC_DECL(close, LIBC_CLOSE_RET_TYPE, LIBC_CLOSE_SIG) +TSOCKS_DECL(close, LIBC_CLOSE_RET_TYPE, LIBC_CLOSE_SIG) #define LIBC_CLOSE_DECL \ LIBC_CLOSE_RET_TYPE LIBC_CLOSE_NAME(LIBC_CLOSE_SIG)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits April 2014